SECURING FIBRE CHANNEL FABRICS - Brocade

Securing the Storage DevicesFor example, a SAN administrator may want to create a Logical Fabricto allow a sensitive project in a shared SAN environment to be managedseparately from the rest of the production environment and tofurther isolate and protect it. Privileges can be assigned to a SANadministrator to manage the special project environment and differentprivileges could be assigned to the same administrator to manage theshared production environment. One benefit of this approach is thatchanges in the special project environment will not cause any disruptionto the shared production environment and vice versa.Authentication of ServersTo further enhance security, strong authentication mechanisms shouldbe employed to authenticate servers joining a fabric. The ANSI T11Technical Committee for FC has a standard that defines the use of anauthentication protocol to authenticate end devices to switches. Thisprotocol, DH-CHAP, uses a shared secret to ensure that the pWWN ofthe HBA joining the fabric has not been spoofed and is in fact genuine.It is possible to change the pWWN on an HBA using tools from HBAmanufacturers, and so it would be possible for someone to configurethe HBA on a server to have the same pWWN as another server on theSAN. Use DH-CHAP and port ACLs to prevent spoofing of a server HBApWWN. Since DH-CHAP also requires end-devices that support DH-CHAP and requires additional management overhead at initial configuration,very few organizations truly feel the need to implement thisfeature.Physical Separation of the FabricAnother method for protecting the production SAN is to simply use aseparate physical SAN dedicated to the DMZ. A separate group of FCswitches could be used to connect all servers inside the DMZ. Storagedevices could also have dedicated ports attached to this switch orentire storage devices could be dedicated to the DMZ servers.Although this is probably a more secure solution, it requires dedicatedhardware and decreases optimization of the storage devices.The diagrams in Figures 38, 39, and 40 illustrate both improper andproper methods of connecting servers in a DMZ to a SAN.Securing Fibre Channel Fabrics 125